Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Identifies the execution of the elementary.pth payload natively triggering on Python interpreter startup. This rule correlates process events for Python execution with file events indicating the presence of an 'elementary.pth' file on the same device.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
This rule detects the presence of components associated with the MYRA rootkit, including specific filenames ('libcache.so', 'memfd_loader') and references to the 'apintergrationpost' npm package or the author 'kimijohn01'. It monitors process command lines, file events, and syslog messages for these indicators.
Detects unauthorized file read activity by node.exe targeting browser-based crypto wallet vault files, specifically 'Local Extension Settings'. This behavior is consistent with infostealer malware (such as Miasma/MYRA) using malicious JavaScript payloads to harvest sensitive encrypted vault data from developer environments.
This rule detects suspicious attempts to access macOS Keychain credentials using the 'security' command-line utility or 'osascript'. It specifically looks for 'security' commands attempting to find generic or internet passwords, unlock keychains, or target browser-specific safe storage keys (Chrome, Brave, Microsoft Edge). It also flags 'osascript' processes accessing Keychain paths. The rule excludes legitimate system and browser processes to reduce false positives.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Detects the execution of specific command primitives associated with the SpectralViper threat actor, identified by the presence of specific 'XGU::Feature::Cmd::' command strings within DeviceEvents AdditionalFields.
Correlates the EDR kill sequence with the attacker utilizing wevtutil to clear the Security and System event logs to cover their tracks. This rule detects the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System' or 'Security' event logs, joined with the creation of a '.sys' file, which could indicate a Bring Your Own Vulnerable Driver (BYOVD) attack attempting to disable EDR and clear logs.
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
Correlates the user interacting with a browser in kiosk mode (potentially indicating a fake tech support page) and immediately downloading an executable file into the Downloads folder. This behavior is indicative of the Havoc Demon loader being delivered via social engineering tactics.
Correlates the execution of known data exfiltration utilities (rclone, mega-cmd, filezilla) passing configuration files or remote cloud repository targets dynamically.
Detects instances where the DllHost.exe process creates or writes files with common executable or script extensions (.exe, .dll, .ps1, .bat, .cmd, .vbs, .hta, .scr, .sh) into suspicious, publicly writable, or temporary directories. This behavior is indicative of potential malicious payload staging, masquerading, or post-exploitation activity.
Detects the NUKESPED backdoor component 'zlrenu8.exe' interacting with the 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' registry key. This activity is consistent with malware performing environment profiling or establishing persistence by targeting registry keys used for automatic startup.
Detects the execution of Red Lamassu's JFMBackdoor payload by monitoring for fltMC.exe being launched from temporary directories. The rule identifies a sideloading technique where fltMC.exe loads a malicious FLTLIB.dll, which then injects the flt.bin shellcode stub into memory, avoiding writing the malicious PE file to disk.
Page 45 of 84